CVE-2016-4443 : Red Hat Enterprise Virtualization (RHEV) Manager 3.6 allows local users to obtain encryption keys, certificates, and oth

Red Hat Enterprise Virtualization (RHEV) Manager 3.6 allows local users to obtain encryption keys, certificates, and other sensitive information by reading the engine-setup log file.

Published 2016-12-14 18:59:01

Updated 2023-02-12 23:20:50

Source Red Hat, Inc.

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2016-4443

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 6 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2016-4443

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
2.1	LOW	AV:L/AC:L/Au:N/C:P/I:N/A:N	3.9	2.9	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
5.5	MEDIUM	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	1.8	3.6	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2016-4443

CWE-532 Insertion of Sensitive Information into Log File

Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2016-4443

http://www.securitytracker.com/id/1036863

Red Hat Enterprise Virtualization Manager Logging Function Lets Local Users View Keys and Certificates - SecurityTracker
Third Party Advisory;VDB Entry
http://www.securityfocus.com/bid/92751

oVirt Engine CVE-2016-4443 Local Information Disclosure Vulnerability
Third Party Advisory;VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1335106

1335106 – (CVE-2016-4443) CVE-2016-4443 org.ovirt.engine-root: engine-setup logs contained information for extracting admin password
Issue Tracking;VDB Entry;Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2016-1929.html

RHSA-2016:1929 - Security Advisory - Red Hat Customer Portal
Mitigation;Patch;Vendor Advisory

Products affected by CVE-2016-4443

Redhat » Enterprise Virtualization » Version: 3.6
cpe:2.3:a:redhat:enterprise_virtualization:3.6:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2016-4443

Exploit prediction scoring system (EPSS) score for CVE-2016-4443

CVSS scores for CVE-2016-4443

CWE ids for CVE-2016-4443

References for CVE-2016-4443

Products affected by CVE-2016-4443